Privacy

OxSlate · last updated 2 September 2026

OxSlate lets one person (the supporter) keep a queue of household admin and send a single calm reminder at a time to another person (the recipient). Because one person is entering information about another, we are deliberately narrow about what we collect and what either side can see.

What we do not collect

Stated first, because these absences are the point of the product rather than gaps we intend to fill:

No read receipts. We do not record whether a reminder was opened or seen. There is no field for it, so it can never be shown to the supporter. We do record the moment you mark something done, stopped, handed back or taken on — your own device needs it, and it is a fact about your own action — and our server removes that moment from the supporter's copy before sending it, so it never reaches their phone. There is no response time, no completion rate and no score anywhere.
No recordings reach us. Speech you dictate is transcribed by your phone's own speech recogniser, and we never receive the audio — only the text it produces, and only when you send it. We ask your phone to transcribe without using the network. Whether it can depends on your device having the offline language pack installed; where it does not, Android's recogniser may send the audio to Google to transcribe it, under Google's privacy policy rather than ours. We are not told which happened, so we do not claim otherwise. We store no audio at any point.
No location, no contacts, no advertising identifier, no analytics or tracking SDKs. The one third-party SDK in the app is a notification delivery service, described below. It is not used to measure or profile anyone.
No passwords, ever. Sign-in, where it is used at all, is a code sent to your own address. We have no password to store or leak.
No account for the recipient. The person receiving reminders never has an account and is never asked for an email address. Their side works with one tap.
We do not sell personal data, and we do not use your content to train AI models.
We do not send marketing email. An address is used to sign you in and for nothing else.

About email sign-in. The supporter may optionally add an email address so their queue can be recovered if they lose or replace their phone. It is optional: the app is fully usable without one. We store a one-way hash of the address rather than the address itself, so our records contain no readable list of who uses OxSlate. Sign-in codes are also stored hashed, expire after ten minutes, and can be used once.

What we do collect

Data	Why	Where it goes
A generated device identifier and access token	To pair two phones and authorise requests without accounts. Tokens are stored hashed.	Our API (AWS, US East)
A hash of the supporter's email address, if they choose to add one	Optional. So a supporter can sign back in and recover their queue on a new phone. Never collected from the recipient.	Our API, and Amazon SES to send the code
Reminder content: subject, due date, category, repeat, any note or link you add	To deliver the reminder to the recipient's phone at the right time	Our API, and the recipient's device
The supporter's display name	Shown on reminders so the recipient knows who asked	Our API, and the recipient's device
Time zone	So reminders arrive at a sensible local hour and respect quiet hours	Our API
The recipient's delivery choices: paused, disconnected, and what happens if a date passes	To enforce their control over delivery	Our API. The escalation choice is never revealed to the supporter.
Text you dictate or type into "Say it once"	To turn a spoken list into separate dated reminders	Our API, then Amazon Bedrock for processing
A photo of a bill or letter, if the supporter uses "Snap a bill"	To read the due date, amount and reference so they do not have to type them. Read once and discarded — never stored.	Our API, then Amazon Bedrock for processing
A photo the supporter attaches to a reminder	So the recipient can see the bill, form or letter the reminder is about. Stored so it can be shown when the reminder arrives, and deleted automatically after 180 days.	Our API and our database. Not sent to any third party.
A push notification token, plus the device identifier above	So a reminder can reach a phone that has not had the app opened on it for a while. See the note below: the reminder itself is not sent to the push provider.	OneSignal, and Google's Firebase Cloud Messaging, which every Android app must use to receive push
Purchase and subscription status	To unlock paid features and restore purchases	RevenueCat and Google Play
Crash and error diagnostics: the type of fault, where in our code it happened, and the phone's model and Android version	So we find out when something breaks. A missed reminder is the one failure this app must not have, and without this we would only learn about it if someone told us. See the note below on what is deliberately left out.	Firebase Crashlytics, part of Google

A crash report contains no reminder. What we receive is a fault type, a line of our own code, and the phone's model and Android version. We deliberately do not attach the subject of a reminder, a supporter's note, anybody's name, or an email address — so a diagnostic report cannot be read as a record of what somebody was reminded about.

Where a report has to identify something, it uses the internal reference numbers for a connection or a delivery. Those are random strings that mean nothing on their own.

Push notifications carry no words. We use OneSignal to wake the recipient's phone, and what we send them is a reference number and nothing else. The phone then writes the reminder from the copy it already holds. So the push provider never receives the subject, the note, the amount, the due date, or the supporter's name — only that a particular device should wake up.

This is a deliberate choice rather than a technical accident. Nearly every app sends the notification text through its push provider, because it is easier. The text here is one person's plain words about another person's health, money or family, and it does not belong on somebody else's servers.

Push is also not how reminders are delivered. Your phone schedules them itself and they arrive with no network connection and no push provider involved. Push exists only to reach a phone that has been dormant long enough to have missed something.

Photos you attach are uploaded, and this changed. This page used to say a photo stayed on the supporter's device and that we stored only a reference to it. That was accurate about what we stored and it meant the feature did not work: a reference to an image on one phone is meaningless on another, so the person receiving the reminder never saw the picture. Attaching a photo of the bill is most of the point of attaching anything, so we now send the image itself.

What that means concretely. When a supporter attaches a photo, it is scaled down and sent to our API, which stores it in our own database alongside the reminder. It is sent to no third party. Either person on that connection can fetch it; nobody else can. It is deleted automatically after 180 days, which is long enough for a reminder scheduled months ahead and not indefinite.

If you would rather a photograph of your paperwork not be uploaded, do not attach one. The reminder works without it, and a reminder whose photo is missing or has expired still arrives with all of its words.

Photographing a bill to read it is different, and only happens when you choose it. If the supporter uses "Snap a bill", that one photo is sent to be read so the date, amount and reference can be filled in for them. It is read and discarded in the same request — never stored by us, and never kept as a copy of the document. Only the text they confirm is saved. That is a separate thing from attaching a photo to a reminder, and it is still not stored.

What each person can see

The supporter can see only that a reminder was delivered, marked done, snoozed, stopped, or that a date passed. Nothing else about the recipient's behaviour is recorded or shown.

The recipient can pause deliveries, stop any single reminder, or disconnect entirely, at any time, without giving a reason. Disconnecting cannot be undone by the supporter — it requires a fresh invitation that the recipient chooses to accept.

Who processes data for us

Amazon Web Services — hosting, storage and scheduled delivery (US East region).
Amazon SES — sends the supporter's sign-in code, if email sign-in is used. It receives the address in order to deliver the message.
Amazon Bedrock — processes dictated or typed text to extract reminders and suggest gentler phrasing. Content is not used to train models.
Amazon Polly — reads a reminder aloud in a natural voice, if the recipient asks for that. It receives the text of that one reminder in order to speak it. No audio is stored on our servers, and your phone's own voice is used instead whenever this is unavailable.
RevenueCat and Google Play Billing — subscriptions and purchase restoration.
Google Play Services — scanning an invitation QR code. Scanning happens inside Play Services, which is why this app needs no camera permission.

Permissions, and why

Notifications — the recipient's entire experience is a notification. Requested during pairing, with an explanation.
Microphone — only while the supporter holds the "Say it once" button. Transcribed on device; no audio is uploaded.
Internet — to carry reminders between the two phones.
Run at startup — scheduled reminders do not survive a reboot without it, and a missed reminder is the failure this app exists to prevent.

Retention and deletion

Reminders are kept while the connection exists. Invitations expire after seven days automatically. Disconnecting deletes the queue from the recipient's device and stops all delivery. Uninstalling ends collection; backups are disabled, so nothing is copied to a cloud account or transferred to a new phone.

Sign-in codes are deleted automatically ten minutes after they are issued, or as soon as they are used. If email sign-in is used, the hashed address and the list of connections it can recover are kept for as long as the account is in use, and expire automatically after about thirteen months without a sign-in.

To have server-side data for a connection deleted, or an email sign-in removed, contact us at the address below and we will remove it. Signing out on the phone deletes the address from that device immediately.

Children

OxSlate is not directed at children and we do not knowingly collect data from children under 13.

Not medical advice

OxSlate is a household organisation and reminder tool. It does not diagnose, treat or provide medical advice, and it is not a medical device.

Contact

Questions, or a deletion request: privacy@dofolabs.space